Privacy Policy

Effective: 1 May 2026 | Last Updated: April 2026 | Replaces all previous versions

1. About this Privacy Policy

This Privacy Policy describes how PropMedia Ltd (trading as lettingaproperty.com) collects, uses, shares, retains, and protects personal data, and the rights you have over the data we hold about you. It should be read alongside our Website and Platform Terms of Use, our Letting Plan Terms, and our Rent Protection Benefit Terms, which together govern your relationship with us.

We are committed to protecting your privacy and to handling your personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR). We never sell your personal data.

By using our website, platform, or services, you confirm that you have read this Privacy Policy and understand how we use your personal data.

2. Who We Are

PropMedia Ltd is the data controller responsible for your personal data. Our details are:

Company: PropMedia Ltd, trading as lettingaproperty.com
Company Number: 06679146
Registered Address: 7 Ardent Court, William James Way, Henley-in-Arden, Warwickshire, B95 5GF
VAT Number: 938118118
Information Commissioner’s Office (ICO) Registration: Z1913589
Scottish Letting Agent Registration: LARN1903038
RentSmart Wales Agent Registration: SR529485
SafeAgent Accreditation: A6443
United Kingdom Association of Letting Agents (UKALA): 83410
Member of The Property Ombudsman scheme
Client Money Protection insurance held

We have not appointed a statutory Data Protection Officer (DPO) as we are not required to do so under UK GDPR. However, our senior management team has overall responsibility for privacy compliance, and privacy queries can be directed to comms@lettingaproperty.com.

3. What Personal Data We Collect

The personal data we collect depends on how you interact with us. The categories below describe the types of data we hold.

3.1 Identity and contact data

Name, date of birth, postal address, email address, telephone number, and any preferred contact details you provide.

3.2 Identity verification and right-to-rent data

Passport, driving licence, or other proof of identity; proof of address; proof of immigration status (for Right to Rent checks in England); and the records of any verification checks we carry out. This may include data classed as “special category” or particularly sensitive under UK GDPR.

3.3 Property and tenancy data

Property addresses, ownership and leasehold details, tenancy agreements, deposit details, rent amounts and payment dates, safety certificates, inspection records, maintenance history, and any other documents related to the let.

3.4 Financial data

Bank account details for rent collection and pay-out, payment history, fees and charges, any arrears or recovery records. We do not store full payment card details — these are processed by our payment provider.

3.5 Reference and credit data

For tenants and guarantors, the results of credit checks, employment references, previous-landlord references, and any other information our referencing provider supplies. This includes financial and employment data.

3.6 Communications data

Records of messages sent through our Messaging Centre, emails, SMS messages, WhatsApp messages, and telephone calls (which may be recorded for training and quality purposes). This includes the content of the communication and metadata such as time, date, and recipient.

3.7 Account and platform usage data

Login credentials (passwords are stored in encrypted form only), account preferences, marketing preferences, and records of your use of features on the platform.

3.8 Technical data

IP address, browser type and version, time-zone setting, device identifiers, operating system, and approximate location derived from your IP address. Collected automatically when you use our website.

3.9 Behavioural and analytics data

Information about how you navigate and interact with our website, including pages visited, links clicked, mouse movements, scrolling, and form interactions. We use this for service improvement and aggregated reporting.

3.10 Marketing and consent data

Your preferences for receiving marketing communications, the lawful basis on which we process your data, and records of consents you have given or withdrawn.

4. How We Collect Personal Data

4.1 Directly from you

Most of the personal data we hold is provided directly by you when you register an account, list a property, apply to rent a property, complete reference forms, sign a tenancy agreement, contact our team, complete an online tool (such as a savings calculator or rental valuation), subscribe to our newsletter, or download a guide.

4.2 From third parties

We also receive personal data about you from:

Our referencing provider (credit checks, employment references, previous-landlord references)
Open banking services (where you authorise us to verify income or rent payments)
Identity verification providers (where used to comply with anti-money-laundering checks)
Other parties to your tenancy (a tenant may provide a guarantor’s details, a landlord may provide a tenant’s details)
Public sources, where relevant (Land Registry, Companies House, electoral roll)
Government bodies and law enforcement, where required

4.3 Automatically when you use our website

When you visit our website, we automatically collect technical and behavioural data through cookies and similar technologies. See Section 12 for details on cookies.

5. Why We Use Personal Data

Under UK GDPR, we must have a lawful basis for processing your personal data. The lawful basis we rely on depends on the purpose. The main purposes and lawful bases are set out below.

5.1 To provide our services to you

We use your personal data to perform our contract with you — including registering and maintaining your account, advertising your property, arranging viewings, carrying out reference checks, drafting and digitally signing tenancy agreements, collecting and paying out rent, protecting deposits, and providing the Rent Protection Guarantee and Rent on Time benefits where applicable.

**Lawful basis: performance of a contract** (UK GDPR Article 6(1)(b)).

5.2 To meet our legal and regulatory obligations

We use your personal data to comply with our obligations under UK law, including (without limitation) anti-money-laundering legislation, Right to Rent checks (England), tax obligations including the Non-Resident Landlord Scheme, deposit protection regulations, the Tenant Fees Act 2019, the Renters’ Rights Act 2025, the Private Housing (Tenancies) (Scotland) Act 2016, the Renting Homes (Wales) Act 2016, and any obligation to report or share data with HM Revenue & Customs, the Department for Work and Pensions, the police, the courts, or other regulators.

**Lawful basis: legal obligation** (UK GDPR Article 6(1)(c)).

5.3 To pursue our legitimate interests

We use your personal data where we have a legitimate business interest, balanced against your rights and freedoms. Our legitimate interests include:

Operating, securing, and improving our website and platform
Preventing and detecting fraud, financial crime, and misuse of our services
Sending you relevant service-related and educational communications
Recommending our own products and services that may be relevant to you, based on your account activity
Recovering debts owed to us
Defending or pursuing legal claims
Conducting research and analytics to improve our services

**Lawful basis: legitimate interests** (UK GDPR Article 6(1)(f)). You have the right to object to processing on this basis — see Section 11.

5.4 With your consent

We rely on consent for some marketing communications, for sharing your data with selected partners (such as our building and contents insurance referral partner where you request a recommendation), for the use of non-essential cookies, and for any processing where consent is the most appropriate legal basis. You can withdraw your consent at any time without affecting the lawfulness of any processing carried out before withdrawal.

**Lawful basis: consent** (UK GDPR Article 6(1)(a)).

5.5 Special category data and Right to Rent

Some of the data we collect (in particular, immigration status data collected for Right to Rent checks, and certain reference and identity-verification data) is treated as “special category data” or otherwise specially protected under UK GDPR and the Data Protection Act 2018. Where we process this kind of data, we rely on additional conditions in DPA 2018 Schedule 1, including (as applicable) substantial public interest, the prevention or detection of unlawful acts, and compliance with statutory obligations such as the Immigration Act 2014 (Right to Rent).

6. Who We Share Personal Data With

We share personal data with the following categories of recipients. We use carefully selected suppliers and put written contracts in place that require them to handle your data securely and only on our instructions.

6.1 Service providers and sub-processors

We engage third-party providers to support the running of our platform and the delivery of our services. The categories include:

CRM and email service providers (we currently use HubSpot for CRM, transactional email, and WhatsApp messaging; and Mailchimp/Mandrill for marketing email)
Hosting and infrastructure providers
Payment processors
Tenant referencing providers
Open banking providers
Identity verification providers
Deposit protection schemes
SMS and telephony providers
Analytics, session-recording, and website-monitoring providers (currently HotJar and Microsoft Clarity)
Document storage and digital-signature providers
Maintenance contractors and trades (where you use our maintenance coordination service)
Solicitors and legal partners (for example, Stephensons Solicitors for stage-5 enforcement under the Legal Support Service)
Postal and print services

A current list of our named sub-processors is available on request from comms@lettingaproperty.com. We will provide it within 14 days of your request.

6.2 Trusted partners

We have referral relationships with selected partners who provide products and services that may be relevant to landlords and tenants. We will only share your data with a trusted partner if you have requested an introduction or specifically consented to be contacted by them. Examples include our building and contents insurance referral partner, Alan Boswell Group, where you request an insurance recommendation in connection with your property. In these cases, the partner becomes an independent data controller and their own privacy policy applies.

6.3 Government, regulators, and law enforcement

We may share personal data with HM Revenue & Customs, the Department for Work and Pensions, the police, the courts, the ICO, local authorities, the Property Ombudsman, and other regulatory or law enforcement bodies where we are legally required to do so or where we believe in good faith that disclosure is necessary to protect our rights, the rights of others, or the integrity of our services.

6.4 Other parties to your tenancy

We share personal data between landlords, tenants, and guarantors as necessary to manage the tenancy — for example, sharing tenant reference results with the relevant landlord, or sharing landlord contact details with the tenant for emergency repairs. We share only what is necessary for the relevant purpose.

6.5 Business transfers

If we sell, restructure, or transfer ownership of our business or assets, your personal data may be transferred to the new owners. We will give you advance notice of any such transfer and ensure that the new owners are bound by privacy commitments at least as protective as those in this Privacy Policy.

6.6 We do not sell your data

We do not sell or rent your personal data to third parties for their own marketing purposes. We do not share your personal data with third parties for them to use for unrelated purposes.

7. International Transfers

Some of our service providers and sub-processors operate outside the United Kingdom. Where we transfer your personal data to a country outside the UK, we ensure that an appropriate safeguard is in place under UK GDPR. The safeguards we rely on include:

Adequacy regulations made by the UK Government, where the destination country has been recognised as providing an adequate level of data protection (this includes the European Economic Area, and a list of other countries published by the UK Government)
The UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses, where adequacy does not apply
Other lawful transfer mechanisms permitted under UK GDPR Article 46 or, in limited specific cases, Article 49 derogations

If you would like more information about the safeguards in place for any specific transfer, please contact comms@lettingaproperty.com.

8. How Long We Keep Personal Data

We retain personal data only for as long as necessary for the purposes for which it was collected, including any legal, accounting, regulatory, or reporting obligations. Our standard retention periods are:

Landlord account data: 7 years after the end of the service contract.
Tenancy documents (including tenancy agreements, deposit records, and right-to-rent records): 6 years after the end of the tenancy. Right-to-rent records are kept for 1 year after the tenancy ends or for the longer period required by law.
Financial records (rent collection, invoices, payments): 7 years, in line with HMRC requirements.
Reference and credit-check data: held in line with our referencing provider’s retention rules — typically 12 months from the date of the check, unless retained longer for fraud-prevention purposes.
Marketing data: until you unsubscribe or otherwise withdraw your consent, plus a short period to record the withdrawal.
Communications data: for the duration of the tenancy or service contract, plus 6 years afterwards, to support potential disputes or claims.
Website analytics and cookie data: typically 12 to 24 months, depending on the cookie or platform.
Data subject to legal hold: held for as long as the relevant legal proceedings or investigation requires.

When personal data is no longer required, we either delete it securely or anonymise it so that it can no longer be linked to you. Anonymised data may be retained indefinitely for statistical and analytics purposes.

9. How We Protect Personal Data

We have appropriate technical and organisational measures in place to protect personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include:

Encryption of data in transit (TLS) and at rest, including for stored documents
Access controls limiting who within our organisation can access personal data, on a need-to-know basis
Strong authentication for staff accounts, including multi-factor authentication where appropriate
Regular review of supplier security practices and contractual data-protection obligations
Staff training on data protection and information security
Logging and monitoring of access to systems handling personal data
Secure deletion procedures when data is no longer required

Despite these measures, no system is completely secure, and we cannot guarantee the absolute security of any data transmitted to or held by us. You also have an important role to play in keeping your account secure — please choose a strong, unique password and notify us promptly if you suspect any unauthorised access. See the Website and Platform Terms of Use, Section 2.3, for further detail on your account security responsibilities.

If we become aware of a personal data breach that creates a risk to your rights and freedoms, we will notify the Information Commissioner’s Office without undue delay and, where required by UK GDPR, will also notify you directly.

10. Your Rights Under UK GDPR

UK GDPR gives you a number of rights in relation to your personal data. The rights you have are summarised below. To exercise any of these rights, please contact comms@lettingaproperty.com.

10.1 The right to be informed

You have the right to be told how we collect and use your personal data. This Privacy Policy is the main way we provide that information.

10.2 The right of access

You have the right to ask us for a copy of the personal data we hold about you, and information about how we use it. We will respond within one month, with the option to extend by up to two further months in complex cases (we will tell you if an extension applies).

10.3 The right to rectification

You have the right to ask us to correct any inaccurate personal data we hold about you, and to complete any incomplete data.

10.4 The right to erasure

Sometimes called the “right to be forgotten”, this is the right to ask us to delete your personal data in certain circumstances. The right is not absolute — we may need to retain some data to comply with legal obligations, defend legal claims, or for other lawful reasons. Where we cannot delete data, we will explain why.

10.5 The right to restrict processing

You have the right to ask us to limit how we use your personal data in certain circumstances — for example, while we investigate a request to correct or object to processing.

10.6 The right to data portability

Where we process your data on the basis of consent or contract, and processing is carried out by automated means, you have the right to ask us to provide a copy of your data in a structured, commonly used, machine-readable format, and to ask us to transfer it to another controller where technically feasible.

10.7 The right to object

You have the right to object to our processing of your personal data where we rely on legitimate interests, and an absolute right to object to direct marketing. Where you object to direct marketing, we will stop using your data for that purpose.

10.8 Rights related to automated decision-making

You have rights in relation to decisions made solely by automated means that produce legal or similarly significant effects on you. We do not currently make decisions of this kind without human involvement, but if we ever do, we will tell you and explain your rights.

10.9 The right to withdraw consent

Where we rely on consent, you can withdraw it at any time. You can unsubscribe from marketing emails by clicking “Unsubscribe” at the bottom of any marketing email, replying STOP to SMS messages, or replying to a WhatsApp marketing message with “Stop promotions”. You can manage your preferences in your account settings, or contact comms@lettingaproperty.com. Withdrawing consent does not affect the lawfulness of any processing carried out before you withdrew.

10.10 The right to complain

If you are unhappy with how we have handled your personal data, you have the right to complain to the Information Commissioner’s Office (ICO). Their contact details are in Section 15. We would, however, appreciate the opportunity to address your concerns directly first.

11. Marketing and Communications

We may send you marketing communications by email, SMS, WhatsApp, post, or telephone, where you have consented to receive them or where we are otherwise permitted to do so under UK GDPR and PECR. You can opt out of marketing communications at any time without affecting our service to you, by:

Clicking “Unsubscribe” at the bottom of any marketing email
Replying STOP to a marketing SMS
Replying with “Stop promotions” to a marketing WhatsApp message
Updating your preferences in your account settings
Contacting us at comms@lettingaproperty.com

Even after you opt out of marketing, we will still send you essential service communications — for example, account notifications, billing reminders, security alerts, and updates to our terms and policies. These are not marketing communications and you cannot opt out of them while you hold an account with us.

12. Cookies and Website Tracking

Our website uses cookies and similar technologies. Cookies are small text files that a website places on your device when you visit. They allow the website to recognise your device and remember information about your visit.

12.1 Categories of cookies we use

**Strictly necessary cookies:** required for the basic operation of our website and platform, including login, session management, and security. These cannot be switched off.
**Functional cookies:** remember choices you make (for example, language or country preference) to improve your experience.
**Analytics cookies:** help us understand how visitors use our website, so we can improve it. These include cookies set by Google Analytics, HotJar, and Microsoft Clarity.
**Marketing and advertising cookies:** used to deliver advertising relevant to your interests, on our website and on other websites you visit.

12.2 Session recording and behavioural analytics

We use HotJar and Microsoft Clarity to understand how visitors interact with our website. These services may record mouse movements, clicks, scrolling, and form interactions in an anonymised or pseudonymised form. They do not record passwords, payment card details, or other sensitive information. Data is used for internal product improvement and aggregated reporting only.

12.3 Managing cookies

You can manage your cookie preferences through our cookie banner when you first visit our website, and you can update your preferences at any time. You can also block or delete cookies through your browser settings — but if you do, some parts of our website may not work as intended.

13. Children

Our services are intended for users aged 18 and over. We do not knowingly collect personal data from children under 18. If you believe a child has provided us with personal data, please contact comms@lettingaproperty.com and we will take appropriate steps to delete it.

14. Updates to this Privacy Policy

We review this Privacy Policy regularly and may update it from time to time to reflect changes in our services, our business, our use of personal data, or the law. The “Last Updated” date at the top of this document tells you when the policy was most recently changed.

Where a change is material, we will give you advance notice by email, by an in-platform notification, or by posting a prominent notice on our website — usually at least 30 days before the change takes effect, except where a shorter period is required by law or by urgent necessity. Your continued use of our services after a change takes effect constitutes acceptance of the updated policy.

15. Contact and Complaints

If you have any questions about this Privacy Policy or about how we handle your personal data, please contact us:

Privacy queries: comms@lettingaproperty.com
General contact: support@lettingaproperty.com
Postal address: PropMedia Ltd, 7 Ardent Court, William James Way, Henley-in-Arden, Warwickshire, B95 5GF

If you are not satisfied with our response to a privacy query or complaint, you have the right to complain to the Information Commissioner’s Office (ICO):

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
Online: ico.org.uk

We would, however, appreciate the opportunity to address your concerns directly before you escalate to the ICO.